dshmarket 1.5.1 → 1.6.0

package/README.md

@@ -25,6 +25,23 @@ dsh plugin --profile web add dshmarket
 
 Restart `dsh web`, then open **Settings → Plugin Market**.
 
+### DSH Desktop
+
+On DSH Desktop builds that expose the public `desktopProfiles` and
+`desktopPnpm` services, install from **Open DSH Terminal** with:
+
+```sh
+dsh plugin add dshmarket
+```
+
+The market automatically targets the immutable active Desktop profile and
+uses Desktop's packaged pnpm operation service. It does not probe or install a
+system pnpm, and Desktop keeps ownership of application restart. Ordinary DSH
+continues to use the existing profile/argv/CLI path when those services are
+absent. The detection order follows Desktop's supported
+[cross-environment plugin contract](https://github.com/anywhere-labs/deepseek-harness-desktop/blob/4f68147091e585aaa1d815f99d30a657b3842d7c/dsh-plugin-desktop/docs/plugin-services.md#cross-environment-plugin-optional-desktop-adapter-and-ordinary-dsh-fallback).
+This compatibility does not mean the market is bundled with Desktop.
+
 ## What you get
 
 - **Browse & search** the full community catalog (300+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
@@ -68,7 +85,7 @@ Live from [awesome-dsh-plugin.com/plugins.json](https://awesome-dsh-plugin.com/p
 
 ### DeepSeek Harness Desktop
 
-[DeepSeek Harness Desktop](https://github.com/anywhere-labs/deepseek-harness-desktop) is a modern desktop client for the DeepSeek Harness ecosystem — start and manage a local Harness service without installing Node.js or touching the command line. Plugin marketplace, mobile remote control, and IM Channels are on its roadmap.
+[DeepSeek Harness Desktop](https://github.com/anywhere-labs/deepseek-harness-desktop) is a modern desktop client for the DeepSeek Harness ecosystem — start and manage a local Harness service without a system Node.js installation. Compatible builds can host a user-installed dsh-market through their public profile and package-operation services; bundling remains a Desktop project decision.
 
 [Website](https://www.dshdesktop.cn) · [GitHub](https://github.com/anywhere-labs/deepseek-harness-desktop)
 

package/README.zh.md

@@ -25,6 +25,21 @@ dsh plugin --profile web add dshmarket
 
 重启 `dsh web`，打开 **设置 → 插件市场**。
 
+### DSH Desktop
+
+如果 DSH Desktop 版本提供公开的 `desktopProfiles` 与 `desktopPnpm`
+服务，可从 **Open DSH Terminal** 安装：
+
+```sh
+dsh plugin add dshmarket
+```
+
+市场会自动使用该代 Desktop 已锁定的活动 profile，以及 Desktop 内置的
+pnpm 操作服务；不会探测或安装系统 pnpm，应用重启仍由 Desktop 负责。
+没有这些服务的普通 DSH 会继续使用现有 profile/argv/CLI 路径。检测顺序遵循
+Desktop 支持的[跨环境插件 contract](https://github.com/anywhere-labs/deepseek-harness-desktop/blob/4f68147091e585aaa1d815f99d30a657b3842d7c/dsh-plugin-desktop/docs/plugin-services.zh.md#跨环境插件可选-desktop-adapter-与普通-dsh-fallback)。
+兼容 Desktop 并不代表市场已预装或捆绑进 Desktop。
+
 ## 你会得到
 
 - **逛与搜**——完整社区目录（300+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
@@ -68,7 +83,7 @@ dsh plugin --profile web add dshmarket
 
 ### DeepSeek Harness Desktop
 
-[DeepSeek Harness Desktop](https://github.com/anywhere-labs/deepseek-harness-desktop) 是一款为 DeepSeek Harness 生态打造的现代化桌面端，让用户无需配置 Node.js 或执行命令，即可启动和管理本地 Harness 服务。项目后续还将支持插件市场、移动端远程控制和 IM Channels。
+[DeepSeek Harness Desktop](https://github.com/anywhere-labs/deepseek-harness-desktop) 是一款为 DeepSeek Harness 生态打造的现代化桌面端，无需在系统中安装 Node.js 即可启动和管理本地 Harness 服务。兼容版本可通过公开的 profile 与包操作服务运行用户自行安装的 dsh-market；是否预装仍由 Desktop 项目决定。
 
 [访问官网](https://www.dshdesktop.cn) · [GitHub](https://github.com/anywhere-labs/deepseek-harness-desktop)
 

package/client/client.js

@@ -442,86 +442,86 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			document.head.appendChild(tag);
 		}
 		var Market_module_css_default = {
-			"star": "eGUBIq_star",
-			"barWave": "eGUBIq_barWave",
-			"filterBtnOn": "eGUBIq_filterBtnOn",
+			"swatches": "eGUBIq_swatches",
+			"body": "eGUBIq_body",
+			"okState": "eGUBIq_okState",
+			"empty": "eGUBIq_empty",
+			"desc": "eGUBIq_desc",
+			"modalNote": "eGUBIq_modalNote",
+			"dangerArmed": "eGUBIq_dangerArmed",
+			"sizeOn": "eGUBIq_sizeOn",
 			"filterTitle": "eGUBIq_filterTitle",
-			"cmd": "eGUBIq_cmd",
-			"sp": "eGUBIq_sp",
-			"descTight": "eGUBIq_descTight",
-			"actWarn": "eGUBIq_actWarn",
-			"staleAction": "eGUBIq_staleAction",
-			"pageBtn": "eGUBIq_pageBtn",
+			"warnLine": "eGUBIq_warnLine",
+			"actLive": "eGUBIq_actLive",
+			"cmdSummary": "eGUBIq_cmdSummary",
+			"foot": "eGUBIq_foot",
+			"filterBtnOn": "eGUBIq_filterBtnOn",
+			"grow": "eGUBIq_grow",
 			"actBroken": "eGUBIq_actBroken",
+			"act": "eGUBIq_act",
+			"pagerSize": "eGUBIq_pagerSize",
+			"pageOn": "eGUBIq_pageOn",
+			"barWave": "eGUBIq_barWave",
+			"tag": "eGUBIq_tag",
+			"head": "eGUBIq_head",
+			"searchInline": "eGUBIq_searchInline",
+			"tab": "eGUBIq_tab",
+			"filterBtn": "eGUBIq_filterBtn",
+			"catsWrap": "eGUBIq_catsWrap",
+			"catsToggle": "eGUBIq_catsToggle",
+			"title": "eGUBIq_title",
+			"themesGrid": "eGUBIq_themesGrid",
+			"nm": "eGUBIq_nm",
+			"pager": "eGUBIq_pager",
+			"irow": "eGUBIq_irow",
+			"pageBtn": "eGUBIq_pageBtn",
+			"staleAction": "eGUBIq_staleAction",
 			"pageInfo": "eGUBIq_pageInfo",
-			"actLive": "eGUBIq_actLive",
+			"err": "eGUBIq_err",
 			"catsCollapsed": "eGUBIq_catsCollapsed",
+			"actWarn": "eGUBIq_actWarn",
 			"actWhy": "eGUBIq_actWhy",
-			"loading": "eGUBIq_loading",
-			"sizeLabel": "eGUBIq_sizeLabel",
-			"cats": "eGUBIq_cats",
-			"bar": "eGUBIq_bar",
-			"pager": "eGUBIq_pager",
-			"titleRow": "eGUBIq_titleRow",
-			"on": "eGUBIq_on",
-			"filterOption": "eGUBIq_filterOption",
-			"dangerArmed": "eGUBIq_dangerArmed",
-			"sect": "eGUBIq_sect",
-			"pct": "eGUBIq_pct",
-			"cancelBtn": "eGUBIq_cancelBtn",
-			"pagerSize": "eGUBIq_pagerSize",
-			"dot": "eGUBIq_dot",
-			"restart": "eGUBIq_restart",
-			"sub": "eGUBIq_sub",
-			"top": "eGUBIq_top",
-			"catsRow": "eGUBIq_catsRow",
 			"src": "eGUBIq_src",
-			"okState": "eGUBIq_okState",
+			"card": "eGUBIq_card",
+			"star": "eGUBIq_star",
 			"dangerBtn": "eGUBIq_dangerBtn",
-			"catsToggle": "eGUBIq_catsToggle",
-			"barFill": "eGUBIq_barFill",
-			"tabs": "eGUBIq_tabs",
-			"sizeOn": "eGUBIq_sizeOn",
-			"modalNote": "eGUBIq_modalNote",
-			"av": "eGUBIq_av",
-			"grid": "eGUBIq_grid",
-			"warnBtn": "eGUBIq_warnBtn",
-			"desc": "eGUBIq_desc",
-			"cmdSummary": "eGUBIq_cmdSummary",
-			"dshmSlide": "eGUBIq_dshmSlide",
+			"pct": "eGUBIq_pct",
 			"filterGroup": "eGUBIq_filterGroup",
-			"irow": "eGUBIq_irow",
-			"foot": "eGUBIq_foot",
-			"row1": "eGUBIq_row1",
-			"filterPanel": "eGUBIq_filterPanel",
-			"nm": "eGUBIq_nm",
-			"spec": "eGUBIq_spec",
-			"spin": "eGUBIq_spin",
-			"card": "eGUBIq_card",
-			"pagerPages": "eGUBIq_pagerPages",
 			"pageEllipsis": "eGUBIq_pageEllipsis",
+			"grid": "eGUBIq_grid",
+			"dshmSlide": "eGUBIq_dshmSlide",
+			"av": "eGUBIq_av",
 			"sizeBtn": "eGUBIq_sizeBtn",
-			"head": "eGUBIq_head",
-			"catsWrap": "eGUBIq_catsWrap",
-			"tab": "eGUBIq_tab",
-			"themesGrid": "eGUBIq_themesGrid",
-			"grow": "eGUBIq_grow",
-			"progress": "eGUBIq_progress",
-			"swatches": "eGUBIq_swatches",
-			"owner": "eGUBIq_owner",
-			"title": "eGUBIq_title",
 			"root": "eGUBIq_root",
-			"searchInline": "eGUBIq_searchInline",
-			"warnLine": "eGUBIq_warnLine",
-			"empty": "eGUBIq_empty",
-			"filterBtn": "eGUBIq_filterBtn",
-			"pageOn": "eGUBIq_pageOn",
-			"body": "eGUBIq_body",
 			"filterWrap": "eGUBIq_filterWrap",
-			"act": "eGUBIq_act",
-			"err": "eGUBIq_err",
+			"pagerPages": "eGUBIq_pagerPages",
+			"row1": "eGUBIq_row1",
+			"owner": "eGUBIq_owner",
+			"warnBtn": "eGUBIq_warnBtn",
+			"tabs": "eGUBIq_tabs",
+			"titleRow": "eGUBIq_titleRow",
+			"barFill": "eGUBIq_barFill",
+			"spec": "eGUBIq_spec",
 			"cmdDetails": "eGUBIq_cmdDetails",
-			"tag": "eGUBIq_tag"
+			"top": "eGUBIq_top",
+			"sub": "eGUBIq_sub",
+			"restart": "eGUBIq_restart",
+			"descTight": "eGUBIq_descTight",
+			"progress": "eGUBIq_progress",
+			"cmd": "eGUBIq_cmd",
+			"bar": "eGUBIq_bar",
+			"cancelBtn": "eGUBIq_cancelBtn",
+			"sect": "eGUBIq_sect",
+			"spin": "eGUBIq_spin",
+			"filterPanel": "eGUBIq_filterPanel",
+			"dot": "eGUBIq_dot",
+			"catsRow": "eGUBIq_catsRow",
+			"sp": "eGUBIq_sp",
+			"loading": "eGUBIq_loading",
+			"on": "eGUBIq_on",
+			"cats": "eGUBIq_cats",
+			"filterOption": "eGUBIq_filterOption",
+			"sizeLabel": "eGUBIq_sizeLabel"
 		};
 		//#endregion
 		//#region src/client/MarketSection.tsx

package/lib/dsh-cli.js

@@ -8,7 +8,7 @@
  */
 import { spawn } from 'node:child_process';
 import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { logEvent } from './log.js';
 import { createProgressTracker } from './ndjson.js';
 import { pluginArgsFor } from './pnpm-compat.js';
@@ -75,6 +75,7 @@ export function killChild(child) {
 /** The child of the operation currently running, for /dsh-market/cancel. */
 let activeChild = null;
 let cancelRequested = false;
+let activeDesktopOperation = null;
 /**
  * Kill a child and its whole tree, gracefully where the platform allows:
  * taskkill /T /F on Windows (plain kill() leaves pnpm children running),
@@ -115,6 +116,12 @@ function killTree(child) {
  * @returns true when there was one to cancel.
  */
 export function cancelActive() {
+    if (activeDesktopOperation !== null) {
+        activeDesktopOperation.userCancelled = true;
+        progress.cancelling = true;
+        activeDesktopOperation.cancel();
+        return true;
+    }
     if (activeChild === null)
         return false;
     cancelRequested = true;
@@ -205,6 +212,34 @@ export const BOOT_ID = `${String(process.pid)}-${String(Date.now())}`;
 const TARGET_RE = /^[A-Za-z0-9@:./_#+-]+$/;
 /** Mutating pnpm commands get the structured reporter appended. */
 const NDJSON_COMMANDS = new Set(['add', 'remove', 'install']);
+/** Apply profile-specific pnpm compatibility and the structured reporter. */
+function preparePluginArgs(profileDirectory, pluginArgs) {
+    let args = pluginArgsFor(profileDirectory, [...pluginArgs]);
+    const target = args[args.length - 1] ?? '';
+    if (!TARGET_RE.test(target)) {
+        return { error: `unsafe plugin target rejected: ${JSON.stringify(target)}` };
+    }
+    if (NDJSON_COMMANDS.has(args[0]))
+        args = [...args, '--reporter=ndjson'];
+    return { args, target };
+}
+/** Reset the singleton status snapshot before one operation starts. */
+function beginProgress(target) {
+    progress.active = true;
+    progress.target = target;
+    progress.startedAt = Date.now();
+    progress.lastLine = '';
+    progress.phase = null;
+    progress.done = 0;
+    progress.total = null;
+    progress.currentPackage = null;
+    progress.downloaded = null;
+    progress.size = null;
+    progress.ndjson = false;
+    progress.error = null;
+    progress.cancelling = false;
+    return createProgressTracker();
+}
 /**
  * Line-buffered progress feed: pnpm's ndjson reporter emits one JSON object
  * per line on stdout, and chunk boundaries can split a line. Human fallback
@@ -231,30 +266,13 @@ function makeProgressFeeder(tracker) {
 /** Run one `dsh plugin --profile <p> …` command with timeout and progress tracking. */
 export function runDshPlugin(profile, pluginArgs) {
     const { file, args, cwd, viaShell } = dshArgv();
-    pluginArgs = pluginArgsFor(profileDir(profile), pluginArgs);
-    const target = pluginArgs[pluginArgs.length - 1] ?? '';
-    if (!TARGET_RE.test(target)) {
-        logEvent('error', 'install', `unsafe plugin target rejected: ${JSON.stringify(target)}`);
-        return Promise.resolve({ exitCode: 1, timedOut: false, stdout: '', stderr: `unsafe plugin target rejected: ${JSON.stringify(target)}`, cancelled: false });
+    const prepared = preparePluginArgs(profileDir(profile), pluginArgs);
+    if ('error' in prepared) {
+        logEvent('error', 'install', prepared.error);
+        return Promise.resolve({ exitCode: 1, timedOut: false, stdout: '', stderr: prepared.error, cancelled: false });
     }
-    // pnpm's structured reporter must be appended after the target is extracted
-    // (the allowlist above validates the last argument).
-    if (NDJSON_COMMANDS.has(pluginArgs[0]))
-        pluginArgs = [...pluginArgs, '--reporter=ndjson'];
-    progress.active = true;
-    progress.target = target;
-    progress.startedAt = Date.now();
-    progress.lastLine = '';
-    progress.phase = null;
-    progress.done = 0;
-    progress.total = null;
-    progress.currentPackage = null;
-    progress.downloaded = null;
-    progress.size = null;
-    progress.ndjson = false;
-    progress.error = null;
-    progress.cancelling = false;
-    const tracker = createProgressTracker();
+    pluginArgs = prepared.args;
+    const tracker = beginProgress(prepared.target);
     const feed = makeProgressFeeder(tracker);
     return new Promise((resolvePromise) => {
         const child = spawn(file, [...args, 'plugin', '--profile', profile, ...pluginArgs], {
@@ -319,6 +337,151 @@ export function runDshPlugin(profile, pluginArgs) {
         });
     });
 }
+/**
+ * Adapt DSH Desktop's generation-scoped package manager to the existing
+ * market runner. There is no runtime import or dependency on Desktop: the
+ * Host supplies this public service only when the package is mounted there.
+ */
+export function createDesktopPluginRuntime(service, activeProfileDir, invokingDir = process.cwd(), timeoutMs = INSTALL_TIMEOUT_MS) {
+    if (!isAbsolute(activeProfileDir) || activeProfileDir.includes('\0')) {
+        throw new Error('dsh-market: Desktop profile directory must be an absolute path without NUL');
+    }
+    if (!isAbsolute(invokingDir) || invokingDir.includes('\0')) {
+        throw new Error('dsh-market: Desktop invoking directory must be an absolute path without NUL');
+    }
+    const owner = Symbol('dsh-market desktop runtime');
+    let closed = false;
+    const runPlugin = async (_profile, pluginArgs) => {
+        if (closed) {
+            return {
+                exitCode: 127,
+                timedOut: false,
+                stdout: '',
+                stderr: 'dsh-market: Desktop package runtime is disposed',
+                cancelled: false,
+            };
+        }
+        const prepared = preparePluginArgs(activeProfileDir, pluginArgs);
+        if ('error' in prepared) {
+            logEvent('error', 'install', prepared.error);
+            return { exitCode: 1, timedOut: false, stdout: '', stderr: prepared.error, cancelled: false };
+        }
+        const abort = new AbortController();
+        let handle;
+        try {
+            handle = service.runPlugin(prepared.args, invokingDir, abort.signal);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const busy = /another desktop pnpm operation is already running/i.test(message);
+            return {
+                exitCode: 127,
+                timedOut: false,
+                stdout: '',
+                stderr: message,
+                cancelled: false,
+                ...(busy ? { busy: true } : {}),
+            };
+        }
+        const tracker = beginProgress(prepared.target);
+        const feed = makeProgressFeeder(tracker);
+        let stdout = '';
+        let stderr = '';
+        let timedOut = false;
+        const collectStdout = (chunk) => {
+            const text = chunk.toString();
+            stdout = (stdout + text).slice(-256 * 1024);
+            feed(text);
+            syncProgress(tracker);
+        };
+        const collectStderr = (chunk) => {
+            const text = chunk.toString();
+            stderr = (stderr + text).slice(-64 * 1024);
+            feed(text);
+            syncProgress(tracker);
+        };
+        handle.stdout.on('data', collectStdout);
+        handle.stderr.on('data', collectStderr);
+        let active;
+        let timer;
+        const done = (async () => {
+            try {
+                const outcome = await handle.done;
+                const failed = outcome.exitCode !== 0 || outcome.signal !== null || timedOut;
+                if (failed)
+                    progress.error = tracker.snapshot.error;
+                const ignoredBuilds = tracker.snapshot.ignoredBuilds;
+                return {
+                    exitCode: outcome.exitCode,
+                    timedOut,
+                    stdout,
+                    stderr,
+                    cancelled: active.userCancelled,
+                    ...(ignoredBuilds.length > 0 ? { ignoredBuilds } : {}),
+                };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                progress.error = tracker.snapshot.error;
+                return {
+                    exitCode: 127,
+                    timedOut,
+                    stdout,
+                    stderr: `${stderr}${stderr === '' ? '' : '\n'}${message}`,
+                    cancelled: active.userCancelled,
+                };
+            }
+            finally {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                progress.active = false;
+                progress.cancelling = false;
+                handle.stdout.off('data', collectStdout);
+                handle.stderr.off('data', collectStderr);
+                if (activeDesktopOperation === active)
+                    activeDesktopOperation = null;
+            }
+        })();
+        active = { owner, cancel: () => { handle.cancel(); }, done, userCancelled: false };
+        activeDesktopOperation = active;
+        timer = setTimeout(() => {
+            timedOut = true;
+            abort.abort(new Error('dsh-market: Desktop package operation timed out'));
+            // The public handle owns an explicit process-tree cancellation path.
+            // Use it as well as AbortSignal so a structurally compatible provider
+            // that does not observe the signal cannot strand the route or teardown.
+            handle.cancel();
+        }, timeoutMs);
+        timer.unref?.();
+        return done;
+    };
+    const cancelOwned = (userCancelled) => {
+        const active = activeDesktopOperation;
+        if (active?.owner !== owner)
+            return false;
+        if (userCancelled)
+            active.userCancelled = true;
+        progress.cancelling = true;
+        active.cancel();
+        return true;
+    };
+    return {
+        runPlugin,
+        // The service is backed by Desktop's packaged pnpm; system discovery and
+        // global provisioning are neither needed nor allowed in this mode.
+        probePnpm: () => Promise.resolve(true),
+        provisionPnpm: () => Promise.resolve({ ok: true }),
+        cancelActive: () => cancelOwned(true),
+        dispose: async () => {
+            closed = true;
+            const active = activeDesktopOperation;
+            if (active?.owner !== owner)
+                return;
+            cancelOwned(false);
+            await active.done.catch(() => { });
+        },
+    };
+}
 /** Copy the tracker's snapshot into the singleton the status route reads. */
 function syncProgress(tracker) {
     const snap = tracker.snapshot;

package/lib/index.js

@@ -2,6 +2,7 @@
  * dsh-market host entry: mounts the market's HTTP routes once the profile
  * composes the webServer and shell services.
  */
+import { createDesktopPluginRuntime } from './dsh-cli.js';
 import { mountMarketRoutes } from './routes.js';
 export const name = 'dsh-market';
 /**
@@ -22,12 +23,41 @@ function argvProfile() {
     return undefined;
 }
 export function apply(ctx, config) {
-    const resolved = {
-        profile: config?.profile ?? argvProfile() ?? 'web',
-        allowRestart: config?.allowRestart ?? true,
-    };
     ctx.inject(['webServer', 'loader'], (hostCtx) => {
         const host = hostCtx;
-        host.effect(() => mountMarketRoutes(host, resolved), 'dsh-market: http routes');
+        const desktopProfiles = ctx.get('desktopProfiles');
+        if (desktopProfiles === undefined) {
+            const resolved = {
+                profile: config?.profile ?? argvProfile() ?? 'web',
+                allowRestart: config?.allowRestart ?? true,
+            };
+            host.effect(() => mountMarketRoutes(host, resolved), 'dsh-market: http routes');
+            return;
+        }
+        // Desktop's supported cross-environment contract guarantees that
+        // desktopProfiles exists before Loader entries mount, and prescribes this
+        // presence check plus a nested desktopPnpm injection:
+        // https://github.com/anywhere-labs/deepseek-harness-desktop/blob/4f68147091e585aaa1d815f99d30a657b3842d7c/dsh-plugin-desktop/docs/plugin-services.md#L190-L243
+        // Ordinary DSH keeps the existing CLI path above.
+        hostCtx.inject(['desktopPnpm'], (desktopCtx) => {
+            const current = desktopProfiles.current;
+            const service = desktopCtx.desktopPnpm;
+            const runtime = createDesktopPluginRuntime(service, current.dir);
+            const resolved = {
+                profile: current.name,
+                profileDirectory: current.dir,
+                // Relaunching a raw Electron process would bypass Desktop's launcher
+                // lifecycle. The shell remains responsible for restart in this mode.
+                allowRestart: false,
+            };
+            const desktopHost = desktopCtx;
+            desktopHost.effect(() => {
+                const disposeRoutes = mountMarketRoutes(host, resolved, runtime);
+                return async () => {
+                    disposeRoutes();
+                    await runtime.dispose();
+                };
+            }, 'dsh-market: Desktop http routes and package operations');
+        });
     });
 }

package/lib/install.js

@@ -62,20 +62,21 @@ export async function withHoistRecovery(run, profile, pluginArgs) {
  * pnpm's `#path:` selector (#18).
  * @returns overall success (true when nothing needed retargeting).
  */
-export async function retargetCollections(run, profile, before, target) {
+export async function retargetCollections(run, profile, before, target, explicitDir) {
     if (!target.startsWith('github:'))
         return true;
-    const junk = Object.keys(readInstalled(profile)).filter((name) => {
+    const dir = profileDir(profile, explicitDir);
+    const junk = Object.keys(readInstalled(profile, dir)).filter((name) => {
         if (before.has(name))
             return false;
-        const root = join(profileDir(profile), 'node_modules', name);
+        const root = join(dir, 'node_modules', name);
         if (!existsSync(join(root, 'package.json')))
             return true;
         return !hasDshManifest(root);
     });
     let allOk = true;
     for (const name of junk) {
-        const root = join(profileDir(profile), 'node_modules', name);
+        const root = join(dir, 'node_modules', name);
         const candidates = pluginSubdirs(root);
         logEvent('info', 'install', `${name}: collection repo (root declares no dsh manifest); plugins inside: ${candidates.join(', ') || 'none'}`);
         await run(profile, ['remove', name]);
@@ -100,13 +101,14 @@ export async function retargetCollections(run, profile, before, target) {
  * next boot, so it is removed on the spot.
  * @returns names kept and names removed as broken.
  */
-export async function validateAddedPlugins(run, profile, before) {
-    const addedNow = Object.keys(readInstalled(profile)).filter(n => !before.has(n));
+export async function validateAddedPlugins(run, profile, before, explicitDir) {
+    const dir = profileDir(profile, explicitDir);
+    const addedNow = Object.keys(readInstalled(profile, dir)).filter(n => !before.has(n));
     const keep = [];
     const removedBroken = [];
     for (const n of addedNow) {
-        const dir = join(profileDir(profile), 'node_modules', n);
-        if (hasDshManifest(dir) && entryArtifactExists(dir)) {
+        const packageDir = join(dir, 'node_modules', n);
+        if (hasDshManifest(packageDir) && entryArtifactExists(packageDir)) {
             keep.push(n);
         }
         else {

package/lib/profile.js

@@ -6,8 +6,14 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-/** Resolve a profile name to its directory under DSH_HOME (default ~/.dsh). */
-export function profileDir(profile) {
+/**
+ * Resolve a profile name to its directory under DSH_HOME (default ~/.dsh).
+ * An explicit directory is used by hosts, such as DSH Desktop, that own the
+ * active profile location rather than deriving it from process environment.
+ */
+export function profileDir(profile, explicitDir) {
+    if (explicitDir !== undefined)
+        return explicitDir;
     const home = process.env.DSH_HOME ?? join(homedir(), '.dsh');
     return join(home, 'profiles', profile);
 }
@@ -24,9 +30,9 @@ const INBOX_BUNDLES = new Set([
     '@deepseek-ai/dsh-headless',
 ]);
 /** Community dependencies of the profile (in-box bundles filtered out). */
-export function readInstalled(profile) {
+export function readInstalled(profile, explicitDir) {
     try {
-        const manifest = JSON.parse(readFileSync(join(profileDir(profile), 'package.json'), 'utf8'));
+        const manifest = JSON.parse(readFileSync(join(profileDir(profile, explicitDir), 'package.json'), 'utf8'));
         const installed = {};
         for (const [name, spec] of Object.entries(manifest.dependencies ?? {})) {
             if (!INBOX_BUNDLES.has(name))
@@ -43,9 +49,9 @@ export function readInstalled(profile) {
  * readInstalled() filters out. This is the rollback snapshot (#65): restoring
  * a filtered view would delete @deepseek-ai/dsh-base and friends.
  */
-export function readManifestDeps(profile) {
+export function readManifestDeps(profile, explicitDir) {
     try {
-        const manifest = JSON.parse(readFileSync(join(profileDir(profile), 'package.json'), 'utf8'));
+        const manifest = JSON.parse(readFileSync(join(profileDir(profile, explicitDir), 'package.json'), 'utf8'));
         return { ...manifest.dependencies };
     }
     catch {
@@ -63,8 +69,8 @@ export function readManifestDeps(profile) {
  * manifest on the next run).
  * @returns names whose entries were dropped or reverted, empty when nothing changed.
  */
-export function restoreManifestDeps(profile, snapshot) {
-    const file = join(profileDir(profile), 'package.json');
+export function restoreManifestDeps(profile, snapshot, explicitDir) {
+    const file = join(profileDir(profile, explicitDir), 'package.json');
     let manifest;
     try {
         manifest = JSON.parse(readFileSync(file, 'utf8'));
@@ -87,9 +93,9 @@ export function restoreManifestDeps(profile, snapshot) {
     return [...touched];
 }
 /** The version actually present in the profile's node_modules, or null. */
-export function readInstalledVersion(profile, name) {
+export function readInstalledVersion(profile, name, explicitDir) {
     try {
-        const manifest = JSON.parse(readFileSync(join(profileDir(profile), 'node_modules', name, 'package.json'), 'utf8'));
+        const manifest = JSON.parse(readFileSync(join(profileDir(profile, explicitDir), 'node_modules', name, 'package.json'), 'utf8'));
         return manifest.version ?? null;
     }
     catch {
@@ -97,10 +103,10 @@ export function readInstalledVersion(profile, name) {
     }
 }
 /** Pinned commit per `owner/repo` from the profile lockfile's codeload tarball URLs. */
-export function readLockCommits(profile) {
+export function readLockCommits(profile, explicitDir) {
     const commits = new Map();
     try {
-        const lock = readFileSync(join(profileDir(profile), 'pnpm-lock.yaml'), 'utf8');
+        const lock = readFileSync(join(profileDir(profile, explicitDir), 'pnpm-lock.yaml'), 'utf8');
         for (const m of lock.matchAll(/codeload\.github\.com\/([^/\s]+\/[^/\s]+)\/tar\.gz\/([0-9a-f]{40})/g)) {
             commits.set(m[1].toLowerCase(), m[2]);
         }
@@ -186,8 +192,8 @@ export function pluginSubdirs(root) {
  * (#6 by @qichuang321.)
  * @returns every package now allowed.
  */
-export function setAllowBuilds(profile, packages) {
-    const file = join(profileDir(profile), 'pnpm-workspace.yaml');
+export function setAllowBuilds(profile, packages, explicitDir) {
+    const file = join(profileDir(profile, explicitDir), 'pnpm-workspace.yaml');
     let yaml = '';
     try {
         yaml = readFileSync(file, 'utf8');